age

Generate an encrypted file that can be decrypted with a passphrase

$ age --passphrase --output [path/to/encrypted_file] [path/to/unencrypted_file]

$ age --recipient [public_key] --output [path/to/encrypted_file] [path/to/unencrypted_file]

$ age --recipients-file [path/to/recipients_file] --output [path/to/encrypted_file] [path/to/unencrypted_file]

$ age --decrypt --output [path/to/decrypted_file] [path/to/encrypted_file]

$ age --decrypt --identity [path/to/private_key_file] --output [path/to/decrypted_file] [path/to/encrypted_file]

Encrypting:
age [OPTIONS] -o OUTPUT_FILE INPUT_FILE
age [OPTIONS] < INPUT_FILE > OUTPUT_FILE

Decrypting:
age -d [OPTIONS] -o OUTPUT_FILE INPUT_FILE
age -d [OPTIONS] < INPUT_FILE > OUTPUT_FILE

-o, --output FILE
    Specify the output file. If not provided, output goes to standard output.

-d, --decrypt
    Decrypt the input. This option changes the command's mode from encryption to decryption.

-a, --armor
    Encrypt to a PEM encoded, ASCII armored format. Useful for sharing via text-based channels.

-R, --recipient-file FILE
    Add recipients from a file, where each line in the file contains a recipient's public key or identity.

-r, --recipient RECIPIENT
    Add a recipient directly using their public key (e.g., age1..) or an SSH public key.

-i, --identity FILE
    Add identities (private keys) from a file for decryption. Can be age private keys or SSH private keys.

-p, --passphrase
    Encrypt or decrypt using a passphrase. The passphrase will be prompted interactively.

-P, --passphrase-file FILE
    Encrypt or decrypt using a passphrase read from the specified file.

--fido
    Use a FIDO2 authenticator for identity (decryption).

--ssh-target TARGET
    When adding recipients from SSH public keys, specify which SSH key type (e.g., `ssh-ed25519` or `ssh-rsa`) to target.

--local-ssh-identities
    Use identities found in common SSH identity locations (e.g., `~/.ssh/id_*`).

-v, --verbose
    Enable verbose output, showing more details about the encryption/decryption process.

-V, --version
    Print the version information and exit.

-h, --help
    Display a help message and exit.

age is a simple, modern, and secure file encryption tool designed for ease of use and robust security. It's built to be a more user-friendly and cryptographically sound alternative to older encryption utilities like GPG, especially for stream encryption. Unlike GPG, age focuses on a minimal and opinionated design, supporting only a few secure cryptographic primitives (currently X25519, ChaCha20-Poly1305, and HKDF).

It supports multiple recipients and different types of identities for decryption, including X25519 keys, SSH keys (both Ed25519 and RSA), passphrases, and FIDO2 authenticators. Its design prioritizes forward secrecy and resistance to common cryptographic attacks. age can encrypt arbitrary data streams, making it suitable for piping with other commands like tar or dd. It provides a clean, human-readable ASCII-armored format for encrypted files, making them easy to share or store.

age does not perform compression or archiving itself; users typically pipe its output/input to/from tools like tar and gzip for these purposes. While it supports SSH keys, it does not directly integrate with `ssh-agent` for managing private keys. Its relatively younger age compared to GPG means a smaller ecosystem and fewer features beyond its core encryption purpose.

age supports several key types for both encryption (recipients) and decryption (identities):

• X25519 Keys: Native age keys, which can be generated using age-keygen.
• SSH Keys: Supports both Ed25519 and RSA public keys as recipients, and their corresponding private keys as identities for decryption. This allows users to leverage existing SSH key infrastructure.
• Passphrases: Simple password-based encryption/decryption.
• FIDO2: Allows using FIDO2 compatible security keys for decryption.

age is designed to work efficiently with data streams. It reads from standard input and writes to standard output by default, making it ideal for piping with other commands. For example, `tar -cvz folder/ | age -r age1... -o encrypted.tar.gz.age` encrypts a gzipped tarball directly.

age was created by Filippo Valsorda, a cryptographer who also works on the Go programming language team at Google. It was designed as a modern, simpler, and more secure alternative to the traditional GNU Privacy Guard (GPG) for file encryption. Valsorda aimed to address common pitfalls and complexities associated with GPG, particularly regarding key management and cryptographic defaults. The project gained significant attention for its clear design principles, robust cryptography (using X25519 for key agreement and ChaCha20-Poly1305 for authenticated encryption), and support for SSH keys as a convenient identity method. It is written in Go, which contributes to its cross-platform compatibility and ease of deployment.

gpg(1), openssl(1), ssh-keygen(1), tar(1), gzip(1)